Skip to content

pydantic-ai

v1.107.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo AI Agents & Assistants
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

agent-framework genai llm pydantic python

Affected surfaces

auth rce_ssrf

ReleasePort's take

Moderate signal
editorial:auto 1mo

VercelAIAdapter now handles `UploadedFile` and `FileUrl` uniformly to eliminate a confused‑deputy file read flaw.

Why it matters: Fixes a high‑severity (90) security vulnerability affecting the VercelAIAdapter UI adapter; operators should apply the update immediately.

Summary

AI summary

Updates 🛡️ Security, 🚀 Features, and 🐛 Bug Fixes across a mixed release.

Changes in this release

Security Critical

Handle `UploadedFile` consistently with `FileUrl` to fix confused-deputy file read vulnerability in VercelAIAdapter.

Handle `UploadedFile` consistently with `FileUrl` to fix confused-deputy file read vulnerability in VercelAIAdapter.

Source: llm_adapter@2026-06-10

Confidence: high

 —
Feature Medium

Add `known_model_names()` to enumerate `KnownModelName` members.

Add `known_model_names()` to enumerate `KnownModelName` members.

Source: llm_adapter@2026-06-10

Confidence: high

 —
Feature Medium

Add `CachePoint` and prompt caching support to openrouter.

Add `CachePoint` and prompt caching support to openrouter.

Source: llm_adapter@2026-06-10

Confidence: high

 —
Feature Medium

Add Claude Fable 5 (`claude-fable-5`) and Claude Mythos 5 (`claude-mythos-5`) model support.

Add Claude Fable 5 (`claude-fable-5`) and Claude Mythos 5 (`claude-mythos-5`) model support.

Source: llm_adapter@2026-06-10

Confidence: high

 —
Dependency Low

Bump python‑packages group with 18 dependency updates.

Bump python‑packages group with 18 dependency updates.

Source: llm_adapter@2026-06-10

Confidence: high

 —
Bugfix Medium

Guard `message=None` Bedrock start events in Anthropic stream path.

Guard `message=None` Bedrock start events in Anthropic stream path.

Source: llm_adapter@2026-06-10

Confidence: high

 —
Bugfix Medium

Fix `AnthropicModel.count_tokens` when native tools are used.

Fix `AnthropicModel.count_tokens` when native tools are used.

Source: llm_adapter@2026-06-10

Confidence: high

 —
Full changelog

What's Changed

🛡️ Security

  • Handle UploadedFile consistently with FileUrl in UI adapters by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/5772
    • Security advisory: VercelAIAdapter trusts client-controlled provider metadata to construct UploadedFile references (confused-deputy file read) https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-h7p7-w5gc-xj3w
    • This fix went out in v1.106.0 and v2.0.0b6.
    • You are affected only if your application passes untrusted client-submitted message history to an agent through a UI adapter (e.g. VercelAIAdapter), AND your model-provider or cloud-storage account holds files referenceable by an attacker-guessable UploadedFile id or storage URI (e.g. s3://…, gs://…).
    • You are not affected if you do not pass untrusted client-submitted message history to the agent, or you strip UploadedFile parts before running it.
    • You are not affected via AGUIAdapter / Agent.to_ag_ui on defaults — the preserve_file_data flag that re-enables this path is off by default.

🚀 Features

  • Add known_model_names() to enumerate KnownModelName members by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/5803
  • feat(openrouter): add CachePoint and prompt caching support by @Adversarian in https://github.com/pydantic/pydantic-ai/pull/4604
  • Add Claude Fable 5 (claude-fable-5) and Claude Mythos 5 (claude-mythos-5) support by @dsfaccini in https://github.com/pydantic/pydantic-ai/pull/5849

🐛 Bug Fixes

  • fix(anthropic): guard message=None Bedrock start events in stream path by @Bartok9 in https://github.com/pydantic/pydantic-ai/pull/5818
  • Fix AnthropicModel.count_tokens with native tools by @kazmer97 in https://github.com/pydantic/pydantic-ai/pull/5704

📦 Dependencies

  • chore(deps): bump the python-packages group across 1 directory with 18 updates by @dependabot[bot] in https://github.com/pydantic/pydantic-ai/pull/5768

New Contributors

  • @Bartok9 made their first contribution in https://github.com/pydantic/pydantic-ai/pull/5818
  • @kazmer97 made their first contribution in https://github.com/pydantic/pydantic-ai/pull/5704

Full Changelog: https://github.com/pydantic/pydantic-ai/compare/v1.106.0...v1.107.0

Security Fixes

  • GHSA-h7p7-w5gc-xj3w — VercelAIAdapter now validates client‑controlled provider metadata to prevent confused‑deputy file read when constructing UploadedFile references
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track pydantic-ai

Get notified when new releases ship.

Sign up free

About pydantic-ai

AI Agent Framework, the Pydantic way

All releases →

Related context

Earlier breaking changes

  • v1.95.0 rename ‘built-in tools’ to ‘native tools’, deprecate old fields, register via capabilities=[NativeTool(...)]

Beta — feedback welcome: [email protected]